Update login.ztml

XSS fixes.

If form action is empty, the target is self script. PHP_SELF not needed.
Merge pull request #106 from japp-0xlabs/patch-3

Removal of FORM POST URL (use of PHP_SELF constant) as not required (code clean-up).